Apache Tomcat contains an authentication bypass vulnerability (CVE-2024-52316) due to unchecked error conditions in custom Jakarta Authentication ServerAuthContext components. If such a component throws an exception during authentication without setting an HTTP failure status, authentication may incorrectly succeed. No known Jakarta Authentication components currently exhibit this behavior. The issue affects multiple Tomcat versions and is fixed in versions 9.0.96, 10.1.30, and 11.0.1.